Timing Oracle in RSA Decryption

Vulnerability

Overview

A timing-based side channel exists in the OpenSSL RSA decryption implementation, affecting all RSA padding modes (PKCS#1 v1.5, RSA-OAEP, RSASVE). The flaw allows an attacker to perform a Bleichenbacher-style attack by observing processing time variations as trial messages are decrypted [1][2]. The root cause is the lack of constant-time processing in the RSA decryption code paths.

Exploitation

Scenario

In a TLS connection, RSA is used to encrypt the pre-master secret sent from client to server. An attacker who observes a genuine TLS handshake can then send a large number of crafted trial messages to the server and measure the time taken for each decryption response. Over many observations, the timing differences can be correlated to recover the original pre-master secret [1][2]. The attack requires no special authentication; the attacker only needs network access to the server.

Impact

Successful exploitation allows the attacker to decrypt the application data exchanged over the original TLS session. This compromises the confidentiality of communications that were previously considered secure. The vulnerability is rated Moderate by OpenSSL, but its practical impact is significant because it targets the core RSA key exchange used in many TLS deployments [1][3].

Mitigation

OpenSSL addressed this issue in versions 3.0.8, 1.1.1t, and 1.0.2zg (premium support) [1][3]. Users are advised to upgrade to these patched versions. There is no workaround available; the fix introduces constant-time RSA decryption to eliminate the timing oracle [1][4].